CCNA Network Infrastructure and Connectivity Practice Question
A network technician is troubleshooting a connectivity issue where a user's email client cannot send messages, but the client can receive emails. The technician uses a protocol analyzer and sees that the client is successfully resolving the mail server's domain name to an IP address and establishing a TCP connection, but the server responds with an application-layer error. At which layers of the OSI model are the problem and the successful operations occurring, respectively?
⚠ Common exam trap
Cisco often tests the distinction between successful lower-layer operations (DNS, TCP) and an application-layer failure, trapping candidates who assume any email problem must be at the Transport or Network layer because they confuse 'connection established' with 'protocol function working'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The problem is at the Application layer (Layer 7); successful operations are at the Application layer (Layer 7) and Transport layer (Layer 4).
The problem is at the Application layer (Layer 7) because the email client can resolve the domain name (DNS, Layer 7), establish a TCP connection (Transport layer, Layer 4), but the mail server returns an application-layer error (e.g., SMTP 550 or 554), indicating the issue lies in the email protocol itself (e.g., authentication failure, mailbox full, or rejected sender). Successful operations include DNS resolution (Application layer) and TCP three-way handshake (Transport layer), confirming layers 7 and 4 are functioning correctly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The problem is at the Transport layer (Layer 4); successful operations are at the Application layer (Layer 7) only.
Why it's wrong here
If the TCP connection were the source of the failure, the three-way handshake would never complete. The technician saw the connection established, which proves the Transport layer (Layer 4) is functioning correctly. The sending error is an SMTP response from the mail server, an Application layer (Layer 7) message that comes after the TCP session is up. Therefore, suspecting Layer 4 contradicts the observed successful handshake and misattributes the fault.
- ✓
The problem is at the Application layer (Layer 7); successful operations are at the Application layer (Layer 7) and Transport layer (Layer 4).
Why this is correct
The sequence of successful operations shows DNS resolution (Application layer, Layer 7) and a TCP handshake to the mail server's port 25 (Transport layer, Layer 4). These two layers are working end-to-end. The mail server returns an SMTP error after the connection is established, such as a rejected recipient or a policy violation. That error is an application-level protocol response, so the fault lies squarely in the Application layer (Layer 7), not in any lower layer.
- ✗
The problem is at the Network layer (Layer 3); successful operations are at the Data Link layer (Layer 2) and Physical layer (Layer 1).
Why it's wrong here
For a TCP connection to succeed, IP packets must be routed between the client and the mail server, so the Network layer (Layer 3) is operational. If Layer 3 were broken, the handshake packets would never arrive and the connection would time out. The technician did observe the TCP handshake, which actually confirms Layer 3 routing and Layer 4 transport are both healthy. The reported failure is a server-generated message at the session's application layer, not a network-layer routing problem.
- ✗
The problem is at the Presentation layer (Layer 6); successful operations are at the Session layer (Layer 5) and Transport layer (Layer 4).
Why it's wrong here
The Presentation layer (Layer 6) handles data format, encryption, and compression; SMTP uses plain ASCII text and does not rely on any special presentation encoding for its commands. The Session layer (Layer 5) and Transport layer (Layer 4) are proven healthy because the TCP session was established and kept open while the mail server transmitted its response. The error is a semantic application-layer reply from the server, such as an SMTP status code. Thus, the fault is at Layer 7, not at Layer 6.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The problem is at the Application layer (Layer 7); successful operations are at the Application layer (Layer 7) and Transport layer (Layer 4).Correct answer▾
Why this is correct
The sequence of successful operations shows DNS resolution (Application layer, Layer 7) and a TCP handshake to the mail server's port 25 (Transport layer, Layer 4). These two layers are working end-to-end. The mail server returns an SMTP error after the connection is established, such as a rejected recipient or a policy violation. That error is an application-level protocol response, so the fault lies squarely in the Application layer (Layer 7), not in any lower layer.
✗The problem is at the Transport layer (Layer 4); successful operations are at the Application layer (Layer 7) only.Wrong answer — click to see why▾
Why this is wrong here
The TCP handshake succeeded, so the Transport layer is working. The error message is generated by the application, not the transport protocol.
✗The problem is at the Network layer (Layer 3); successful operations are at the Data Link layer (Layer 2) and Physical layer (Layer 1).Wrong answer — click to see why▾
Why this is wrong here
Successful TCP connection implies IP routing (Layer 3) is working. The error is not related to addressing or routing.
✗The problem is at the Presentation layer (Layer 6); successful operations are at the Session layer (Layer 5) and Transport layer (Layer 4).Wrong answer — click to see why▾
Why this is wrong here
Email sending failures are typically application logic errors, not encryption/formatting or session problems. Also, DNS is an Application layer protocol, not Session or Presentation.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
OSI Model Reference
| Layer | Name | PDU | Key Protocols / Devices |
|---|---|---|---|
| 7 | Application | Data | HTTP, HTTPS, DNS, SMTP, FTP, SSH |
| 6 | Presentation | Data | TLS / SSL, JPEG, ASCII encoding |
| 5 | Session | Data | NetBIOS, RPC, SIP |
| 4 | Transport | Segment / Datagram | TCP, UDP |
| 3 | Network | Packet | IP, ICMP, OSPF — Routers |
| 2 | Data Link | Frame | Ethernet, Wi-Fi, PPP — Switches, Bridges |
| 1 | Physical | Bits | Cables, NICs, Hubs, Repeaters |
Go deeper
Related to this question
Learn chapter
The OSI Model
Key term
SMTP
SMTP (Simple Mail Transfer Protocol) is the standard internet protocol used to send emails from a client to a server or between email servers.
Key term
Post Office Protocol
Post Office Protocol (POP) is a standard internet protocol used by email clients to retrieve email from a remote server and download it to the user's local device.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.